CI: seven checks red on main independent of PR content (tests.ipkg, assert_total, SPDX, 4 governance/scan) #230

Activity

1. github-actions

   added

   choreRoutine maintenance with no behaviour changeRoutine maintenance with no behaviour change

   cicdCI/CD: workflows, actions, lockfiles, pins, runners, release gatesCI/CD: workflows, actions, lockfiles, pins, runners, release gates

   governancePolicy, rulesets, standards, compliance, and their enforcementPolicy, rulesets, standards, compliance, and their enforcement

   licensingLicences, SPDX headers, REUSE compliance, attributionLicences, SPDX headers, REUSE compliance, attribution

   on Oct 6, 2026
2. hyperpolymath commented on Oct 6, 2026

   

   hyperpolymath

   on Oct 6, 2026

   OwnerAuthor

   More actions

   Triage (read-only, 2026-10-06; CI on #229 head bb82eeb, cross-checked against main @ ced0ca5)

   Bottom line: 7 red checks, but only 3 underlying problems in this repo, plus 1 dead action pin and 1 bug in a shared standards script. No secret has leaked.

   #	Check	Root cause	Real problem?	Fix	Effort
   1	scan / gitleaks	3 hits, all test fixtures: src/Proven/SafeAPIKey/Proofs.idr:41,46 (sk_live_abc123de… / sk_test_abc123de…, placeholder Stripe keys used in detectFormat … = StripeKey proofs), and tests/unit/SafeJWTUnit.idr:37 (the public jwt.io example token, sub 1234567890)	No: false positives	Add the 3 fingerprints to .gitleaksignore	~5 min
   2	governance / Workflow security linter	One dead pin: ocaml/setup-ocaml@4462cc269f8d… in .github/workflows/ocaml-ci.yml:99,154. The API returns "No commit found for SHA"; reproduced locally with standards/scripts/check-action-pins-resolve.sh (1 of 37). An unresolvable uses: means that job never runs.	Yes: OCaml CI is silently dead	Repin to v3 → 93303b622b2522e4411e295f9e77411a24912ac7 (resolved today), and update actions.lock if present	~10 min
   3	Aspect — Safety Invariants	22 non-comment assert_total / assert_smaller / believe_me lines in 9 src/ files (SafeYAML/Parser ×6, SafeXML/Parser, SafeRegex/Matcher, SafeArgs/Parser, SafeTree, SafeTOML, and the SafeCORS, SafeJWT and SafeMath Proofs)	Yes: each one is an unchecked totality claim	Rewrite to structural or fuel/sizeAccessible recursion; 4f8d7fa (CodeRabbit agent, unreviewed) attempts this	1–2 days
   4	governance / Trusted-base reduction policy	Same root as #3: 17 of 30 escape hatches are undocumented (SafeXML/Parser ×8, SafeYAML/Parser ×6, SafeRegex/Matcher ×3). The other 13 are covered by .trusted-base-ignore, or enumerated in docs/proof-debt.adoc	Yes (same)	Fixing #3 fixes this. The stopgap is a TRUSTED: comment plus a docs/proof-debt.adoc entry each, but the stopgap documents the debt rather than paying it	included in #3
   5	Enforce Trustfile Policies	5 files carry SPDX-License-Identifier: Palimpsest-MPL-1.0 (SafeYAML/Parser, SafeSQL/Builder, SafeRegex/Parser, SafeRegex/Matcher, SafeXML/Parser); the rest of src/ moved to MPL-2.0 in 0eb9709 (2026-05-22)	Licence hygiene	Change the 5 headers to MPL-2.0	~5 min, but needs the owner's OK (relicensing)
   6	build (0.8.0)	proven.ipkg builds 305/305. tests.ipkg then fails with 13 errors in tests/properties/SafeMathProps.idr: it calls safeAdd, safeSub, safeNegate, safeAbs, detectOverflow and getValue, which Proven.SafeMath no longer exports. bdb1863 (2026-05-11, "align Safe* surface with idaptik #8") renamed them to addChecked, subChecked, absSafe, … and the tests were not updated	Yes: no property test has run since May	Port SafeMathProps to the new names, then fix whatever the next module reveals	0.5–1 day (see horizon)
   7	governance / Validate Hypatia Baseline	The tool crashes before it can judge: apply-baseline.sh: line 262: /usr/bin/jq: Argument list too long, exit 126. hyperpolymath/standards scripts/apply-baseline.sh:187 passes the whole findings file via --argjson findings "$FINDINGS_JSON", which overflows the per-argument limit (MAX_ARG_STRLEN, 128 KiB) once there are 298 findings	Tool bug in standards, not here; the gate itself is untested	Upstream: --slurpfile / stdin instead of --argjson. Then this repo must face 298 findings (critical=133, high=34, medium=107) against a 30-entry .hypatia-baseline.json	upstream ~30 min; repo-side unknown until the crash is fixed

   Suggested order

   1. Welcome to proven Discussions! #1 + chore(ci): Maximize CI/CD values (Dependabot & Permissions) #2: one small PR, two checks green, and OCaml CI comes back.
   2. ci(antipattern): broaden TS allowlist (cli, mod.ts, lsp-server, *vscode*, deno-*) #5: once the owner OKs MPL-2.0 for those 5 files.
   3. ci(antipattern): TS check reads .claude/CLAUDE.md exemption table #6: restores the test signal, which matters most for a repo named proven.
   4. Add Green Web Foundation badge #3/ci(antipattern): allowlist legit TS bridge/adapter paths #4: the real proof-debt work; review 4f8d7fa first.
   5. ci(antipattern): fix top-level dir + benchmark/lsp filename matching #7: blocked on the standards script fix; then triage the 298 Hypatia findings.

   Horizon of this triage

   • tests.ipkg stops at its first failing module. The other 31 of its 32 modules are unobserved, so more breakage after SafeMathProps is likely; ci(antipattern): TS check reads .claude/CLAUDE.md exemption table #6's estimate assumes it.
   • I did not see what the 133 "critical" Hypatia findings are. The scan's output never reached a readable report, because the baseline step crashed. That count is Hypatia's own label, unverified.
   • The assert_total count comes from git grep on main excluding --/||| comment lines, and matches the Aspect check's list. The Trusted-base count (30, of which 17 are undocumented) is the CI script's own figure.
3. hyperpolymath

   added 4 commits that reference this issue on Oct 6, 2026

   fix(SafeFiniteField): reject irreducibles not of degree n before redu…

   ...

   a32c3b6

   chore(secrets): ignore three gitleaks test-fixture false positives (#231

   ...

   5360032

   docs: add AFFIRMATION.adoc anchored at 5360032 (#232)

   ...

   6071d0b

   docs: mark AFFIRMATION as agent-authored DRAFT, not owner-affirmed (#233

   ...

   a7503b2